Approach overview (high level)
I would run a layered assessment: control plane, nodes/pods, RBAC, admission controllers, network policies, image provenance, and runtime behavior — combining automated scans (kube-bench, kube-hunter, trivy), manual inspection, and exploitation attempts.
Control plane
- Check API server flags, unauthenticated endpoints, audit logging, etc.
- Verify etcd access controls and TLS; try read-only access to etcd snapshots where permitted.
Node & pod security
- Inspect kubelet settings (anonymous auth, read-only port), hostPath mounts, privileged containers, CAP_SYS_ADMIN.
- Use kubectl exec/attach to test lateral movement; attempt container escape primitives (mounting /proc, abusing ptrace, CVEs).
RBAC
- Inventory ClusterRoleBindings and ServiceAccounts with wide scopes.
- Attempt privilege escalation via impersonation or token theft (read secrets via API).
Admission controllers
- Verify PodSecurity admission, PSP/PSA enforcement, and dynamic admission webhook behavior; bypass misconfigured webhooks.
Network policies
- Map pod-to-pod connectivity (calico/iptables) via port scans from pods; identify permissive all-allow policies.
Image provenance
- Scan images with trivy; check registries for unsigned images, use of latest tags, accessible private registries.
Runtime behavior
- Monitor processes, capabilities, syscalls; test detection by EDR; simulate persistence (create CronJobs/DaemonSets).
Exploit example: permissive PSP / ServiceAccount
- If PSP allows privileged containers or hostPath and a ServiceAccount is bound to cluster-admin, I would:
- create a Pod using that SA with hostPath / and privileged true;
- mount host filesystem and kubelet credentials (/var/lib/kubelet) to retrieve node creds;
- use host namespace or docker/socket to run containers on host, escalate to root and pivot to other nodes or to the API server using stolen tokens.
- If a ServiceAccount has TokenReview or secrets get, I can read other SA tokens and chain to cluster-admin.
Remediation highlights
- Enforce least privilege RBAC, restrict PSP/PSA to non-privileged, disable kubelet anonymous/read-only ports, enable audit logging, sign images, and enforce strict NetworkPolicies and admission webhooks.
